Windows 8, IE10 suffer multiple critical zero-day vulnerabilities

Researchers at Vupen, a private security firm based in France, claim to have found multiple, critical vulnerabilities in Windows 8 and Internet Explorer 10. The team's exploits allow hackers to remotely execute code, allowing crafty individuals to potentially gain control of a Windows 8 computer. PCWorld's naughtily-named article has the details. 

Despite Vupen's contrarian discoveries, Windows 8 is easily Microsoft's most secure operating system ever: system-wide SmartScreen, ASLR, Secure Boot, Metro app sandboxing are just a few of the reasons why. Even Vupen's CEO seems to agree with this assessment, stating "This new Microsoft operating system is definitely the most secure version of Windows so far".

Admittedly though, the bar hasn't been set very high by previous Windows versions. Critical vulnerabilities are seemingly found on a weekly basis, but I don't believe anyone expects such a huge, sprawling bundle of code to be unhackable -- especially this close after launch.

Because of how Vupen operates, details regarding these zero-day Windows 8 vulnerabilities will remain a public mystery. What the company has said though, is that its found ways to bypass AntiROP (anti-Return Oriented Programming), DEP (Data Execution Prevention), HiASLR (High-Entropy Address Space Layout Randomization) and IE10's sandboxing mechanism.

Vupen is a for-profit security research firm who essentially sells their proprietary exploits to the highest bidder -- a fact which has drawn a fair amount of public criticism. While white hat hackers aim to find vulnerabilities for the purpose of helping developers improve their security, Vupen does so to make a profit. The company keeps its findings private until it can sell information about the vulnerability to an interested client -- clients are often times large companies or governmental agencies.

Vupen's crack team of security researchers are actually known for discovering numerous vulnerabilities across many programs, but perhaps most notably developing a high-profile exploit for Chrome which allowed experts to bypass Chrome's oft-touted sandbox protection.